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We provide a tight analysis of Grover's recent algorithm for quantum database searching. We give 
a simple closed-form formula for the probability of success after any given number of iterations of 
the algorithm. This allows us to determine the number of iterations necessary to achieve almost 
certainty of finding the answer. Furthermore, we analyse the behaviour of the algorithm when the 
element to be found appears more than once in the table and we provide a new algorithm to find such 
an element even when the number of solutions is not known ahead of time. Using techniques from 
Shor's quantum factoring algorithm in addition to Grover's approach, we introduce a new technique 
for approximate quantum counting, which allows to estimate the number of solutions. Finally we 
provide a lower bound on the efficiency of any possible quantum database searching algorithm and 
we show that Grover's algorithm nearly comes within a factor 2 of being optimal in terms of the 
number of probes required in the table. 



1 Introduction 

Assume you have a large table T[Q . . N — 1] in which 
you would like to find some element x. More precisely, 
you wish to find an integer i such that < i < N and 
T[i] — x, provided such an i exists. This problem can 
obviously be solved in a time in 0(log N) if the table is 
sorted, but no classical algorithm (deterministic or prob- 
abilistic) can succeed in the general case — when the el- 
ements of T are in an arbitrary order — with probability 
better than 1/2, say, without probing more than half the 
entries of T. Grover has recently discovered an algo- 
rithm for the quantum computer that can solve this prob- 
lem in expected time in 0(V~N~ ). He also remarked that 
a result in 0] implies that his algorithm is optimal, up 
to a multiplicative constant, among all possible quantum 
algorithms. 

In this paper we provide a tight analysis of Grover's 
algorithm. In particular we give a simple closed-form for- 
mula for the probability of success after any given number 
of iterations. This allows us to determine the number of 
iterations necessary to achieve almost certainty of finding 
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the answer, as well as an upper bound on the probability 
of failure. More significantly, we analyse the behaviour of 
the algorithm when the element to be found appears more 
than once in the table. An algorithm follows immediately 
to solve the problem in a time in 0(y / N/t ) when it is 
known that there are exactly t solutions. We also provide 
an algorithm capable of solving the problem in a time in 
0{\fN/t ) even if the number t of solutions is not known 
in advance. Bringing ideas from Shor's quantum factor- 
ization algorithm j^] into Grover's algorithm, we sketch a 
new quantum algorithm capable of approximately count- 
ing the number of solutions. We also generalize Grover's 
algorithm in the case N is not a power of 2. Finally, we 
refine the argument of Q to show that Grover's algorithm 
could not be improved to require much less than half the 
number of tabic lookups that it currently makes when a 
50% probability of success is desired. 

2 Finding a unique solution 

Assume for now that there is a unique iq such that 
T[io] = x. For any real numbers k and t such that 
k 2 + (N — 1)£ 2 — 1, define the state of a quantum register 



|*(M)> = fc|io> 



where the sum is over all i ^ Iq such that < i < N. 
(We shall never need complex amplitudes in this paper, 
except in §M.) 
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The heart of Grover's algorithm is a process, henceforth 
called an iteration, that efficiently transforms \^(k,£)) 
into |*(^* + ^ r 11 £, - Although we re- 

view the iteration process in §^ — where we call it G — 
we refer the reader to Grover's original article jl| for a 
more complete description and the proof that it performs 
as required. Grover's algorithm begins by creating an 
equal superposition 



7V-1 



|* ) = \*(i/Vn,i/Vn)) = 



1 



i=0 



N 



of all possible values for i, < i < N. Then some num- 
ber to of iterations are performed. It is clear from the 
above discussion that the effect of the j-th iteration is 
to produce state \^j)=\^(kj,£j)) where ko — lo = 1/vN 
and 



N-2 



I. . 

N ^3 



N-2 , 
N * 



2(jV-l) 
N * 



(1) 



Finally, state \^ m ) is observed, yielding some value i. 
The algorithm succeeds if and only if T[i] = x. 

In his paper, Grover proves that there exists a number 
m less than \/2N such that the probability of success after 
m iterations is at least 1/2. This is correct, but one must 
be careful in using his algorithm because the probability 
of success does not increase monotonically with the num- 
ber of iterations. By the time you have performed \ // 2N 
iterations, the probability of success has dropped down 
to less than 9.5% and it becomes vanishingly small after 
about 11% more iterations before it picks up again. This 
shows that it is not sufficient to know the existence of m 
in order to apply the algorithm in practice: its explicit 
value is needed. 

The key to a tighter analysis of Grover's algorithm is 
an explicit closed-form formula for kj and £j. This can 
be obtained by standard techniques — and a little sweat — 
from recurrence ([!]). Let angle 9 be defined so that 
sin 2 9 = l/N. It is straightforward to verify by mathe- 
matical induction that 



k 3 = sin((2j + 1)0) 



l i = ^=r cos (( 2 J + 1 ) ) 



(2) 



It follows from equation (g) that k m = 1 when 
(2m + 1)6* = 7r/2, which happens when to = (tt — 20)/40. 
Of course, we must perform an integer number of itera- 
tions but it will be shown in the next section that the 
probability of failure is no more than l/N if we iterate 
[7r/40J times. This is very close to jVN when N is large 
because 9 « sin0 = 1/yN when 9 is small. It is sufficient 
to perform half this number of iterations, approximately 
| V~N, if we are content with a 50% probability of success, 
as Grover considered in his original paper H . However, if 



we work twice as hard as we would need to succeed with 
almost certainty, that is we apply approximately 
iterations of Grover's algorithm, we achieve a negligible 
probability of successl 

3 The case of multiple solutions 

Let us now consider the case when there are t solutions 
to the problem, that is there are t different values of i 
such that T[i] — x. We are interested in finding an ar- 
bitrary solution. Grover briefly considers this setting fl] , 
but he provides no details concerning the efficiency of his 
method. 

We assume in this section that the value of t is known. 
Let A = {i | T[i] = x} and B = {i \ T[i] ^ x}. For any real 
numbers k and I such that tk 2 + (N — t)£ 2 = 1 , redefine 

\*(k,t)) = j2m+J2 i \ i )- 



ieB 



A straightforward analysis of Grover's algorithm shows 
that one iteration transforms \^(k,£)) into 

M^k + ^e,^£-%k)). 

This gives rise to a recurrence similar to (Q), whose so- 
lution is that the state \^(kj, £j)) after j iterations is 
given by 



kj = -l=sin((2j + l)0) 

l i = 7F=r cos (( 2 J + 1 ) ) 



(3) 



where the angle 9 is chosen so that sin 2 9 = t/N. 

The probability of obtaining a solution is maximized 
when £ m is as close to as possible. We would have 
£,~ n = when to = (tt — 29) /AQ if that were an integer. 
Let to = [tt/49\. Note that \m-m\< 1/2. It follows 
that | (2m + 1)6» - (2to + 1)9\ < 9. But (2m + 1)6* = tt/2 
by definition of to. Therefore | cos((2to + 1)9) \ < \ s'm9\. 
We conclude that the probability of failure after exactly 
to iterations is 

(N - t)£ 2 m = cos 2 ((2to + 1)6») < sin 2 9 = t/N. 

This is negligible when t <§; N. 

Note that this algorithm runs in a time in 0(yj N/t ) 
since 9 > sin 9 = Wt/N and therefore 

TT 7T [N~ 

~ 46 1 ~ 4 V t 

A slight improvement is possible in terms of the ex- 
pected time if we stop short of to iterations, observe the 
register, and start all over again in case of failure. The ex- 
pected number of iterations before success with this strat- 
egy is E(j) — j /tk 2 if we stop after j iterations since our 
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probability of success at that point is tkj. Setting the 
derivative of E(j) to tells us that the optimal number 
of iterations is given by the j so that 49 j = tan((2j + 1)9). 

We have not solved this equation exactly but it is very 
close to z = tan(z/2) with z = 49 j when the optimal j is 
large, which happens when t -C N. The solution for z is 
approximately 2.33112. It follows that the optimal num- 
ber of iterations is close to 0.58278-\/A/i when t <C N and 
the probability of success is close to sin 2 (z/2) f» 0.84458. 
Therefore, the expected number of iterations before suc- 
cess if we restart the process in case of failure is roughly 
[z / (4 sin 2 (z/ 2))) ^/WJt « OmOOSy^N/t, which is about 
88% of j \J N/t, the number of iterations after which suc- 
cess is almost certain. For a numerical example, consider 
the case N = 2 20 and t = 1. In this case, we achieve al- 
most certainty of success after 804 iterations. If, instead, 
we stop at 596 iterations, the probability of success is 
only 0.8442 but the expected number of iterations be- 
fore success if we restart the process in case of failure is 
596/0.8442 w 706, which is indeed better than 804. 

3.1 The case t = N/4 

An interesting special case occurs when t = N/4. 
Of course, even a classical computer can find a solu- 
tion efficiently in this case, with high probability, but 
not quite as efficiently as a quantum computer. Here 
sin 2 9 = t/N =1/4 and therefore 9 = tt/6. This implies 
that 

tx = , 1 cos(30) = . 

In other words, a solution is found with certainty after a 
single iteration. Because one iteration of Grover's algo- 
rithm requires two table look-ups (including one for un- 
computation purposes — see §Q), this is twice as efficient 
(in terms of table look-ups) than the expected perfor- 
mance of the obvious classical probabilistic algorithm — 
and that's best possible classically. Furthermore, the 
quantum algorithm becomes exponentially better than 
any possible classical algorithm if we compare worst-case 
performances, taking the worst possible coin flips in the 
case of a probabilistic algorithm. This is somewhat remi- 
niscent of the Deutsch-Jozsa algorithm . 



4 Unknown number of solutions 

A much more interesting case occurs when the number 
of solutions is not known ahead of time. If we decide to 
iterate jy/~N times, which would give almost certainty of 
finding a solution if there were only one, the probability 
of success would be vanishingly small should the num- 
ber of solutions be in fact 4 times a small perfect square. 
For example we saw above that we are almost certain to 
find a unique solution among 2 20 possibilities if we iterate 



804 times. The same number of iterations would yield a 
solution with probability less than one in a million should 
there be 4 solutions! In order to find a solution efficiently 
when their number is unknown, we need the following 
lemmas, the first of which is proved by straightforward 
algebra. 

Lemma 1 For any real numbers a and 3, and any posi- 
tive integer m, 



E 1 . sm(md) cos(a + (m — 1)3) 
cos(a + 20 j) = — 

0=0 



sin/3 



In particular, when a = (3, 



m — l ■ fn \ 

cos 2j + l a = — 1 L 

2 sin a 

3=0 



Lemma 2 Let t be the (unknown) number of solutions 
and let 9 be such that sin 2 9 = t/N. Let m be an ar- 
bitrary positive integer. Let j be an integer chosen at 
random according to the uniform distribution between 
and m — l. If we observe the register after applying j iter- 
ations of Grover's algorithm starting from the initial state 
l^o) = J2i ^ e probability of obtaining a solution 

is exactly 

1 s'm(4m9) 

2 ~ 4m sin(20) ' 

In particular P m > 1/4 when m > 1/ sin(20). 

Proof. The probability of success if we perform j itera- 
tions of Grover's algorithm is ifc 2 = sin 2 ((2j + 1)9). It fol- 
lows that the average success probability when < j < m 
is chosen randomly is 



Pi I 



m— X -. 

P m = J2 -sin 2 ((2j + l)fl) 

3=0 
- m— 1 

= — £l-cos((2j + l)20) 
2m ' 

3=0 

1 sin(4m#) 



2 4m sin(20) 
If m > l/sin(20) then 



sin(4m#) 



< 



1 



< 



1 



4msin(2#) ~ 4msin(26») ~ 4 ' 

The conclusion follows. I 

We are now ready to describe the algorithm for finding 
a solution when the number t of solutions is unknown. 
For simplicity we assume at first that 1 < t < 3iV/4. 

1. Initialize m = 1 and set A = 6/5. 

(Any value of A strictly between 1 and 4/3 would do.) 
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choose j uniformly at random among the nonnegative 
integers smaller than m. 

Apply j iterations of Grover's algorithm starting 
from initial state |^o) = J2i T^K)- 

Observe the register: let i be the outcome. 

If T[i] — x, the problem is solved: exit. 



6. Otherwise, set m to min(Am, yN) 
and go back to step 2. 

Theorem 3 This algorithm finds a solution in expected 
time in 0(y/N/t ). 

Proof. Let 9 be the angle so that sin 2 9 = t/N . Let 



too = l/sin(20) 



N 



2y/{N-t)t 



< 



(recall that we assumed t < 3JV/4). 

We shall estimate the expected number of times that 
a Grover iteration is performed: the total time needed is 
clearly in the order of that number. On the s-th time 
round the main loop, the value of m is A^ 1 and the 
expected number of Grover iterations is less than half 
that value since j is chosen randomly so that < j < to. 
We say that the algorithm reaches the critical stage if it 
goes through the main loop more than [ log A too] times. 
The value of m will exceed too if and when the algorithm 
reaches that stage. 

The expected total number of Grover iterations needed 
to reach the critical stage, if it is reached, is at most 



E a* 



< 



1 A 



2 A- 1 



toq = 3toq . 



Thus, if the algorithm succeeds before reaching the critical 
stage, it does so in a time in O(too), which is in 0(y/N/t ) 
as required. 

If the critical stage is reached then every time round the 
main loop from this point on will succeed with probability 
at least 1/4 by virtue of Lemma || since m > 1/ sin(20). 
It follows that the expected number of Grover iterations 
needed to succeed once the critical stage has been reached 
is upper-bounded by 



1 OSi \ 

2 4 «+i 8-6X 

u=0 



to 



-m . 



The total expected number of Grover iterations, in case 
the critical stage is reached, is therefore upper-bounded 
by |too and thus the total expected time is in 0(y/N/t ) 
provided < t < 3JV/4. Note that |m « |vW* when 
t <C N, which is less than four times the expected number 



of iterations that we would have needed had we known the 
value of t ahead of time. The case t > 3N/4 can be dis- 
posed of in constant expected time by classical sampling. 
The case t = is handled by an appropriate time-out in 
the above algorithm, which allows to claim in a time in 
0(y/~N ) that there are no solutions when this is the case, 
with an arbitrarily small probability of failure when in 
fact there is a solution. I 



5 Quantum counting 

We are currently investigating the power of quantum com- 
puters in approximately counting the number t of solu- 
tions, rather than merely finding one. For this, we use 
techniques inspired by Shor's celebrated quantum factor- 
ization algorithm |jj and combine them with Grover's 
algorithm. Here we sketch the basic ideas, leaving the 
details — many of which still have to be worked out — to a 
further paper ||. 

Let kj and lj be as in equation (||) and recall that 
A = {i | T[i] = x} and B = {i | T[i] 7^ x}. The key obser- 
vation is that the value of 9, and therefore that of t, can be 
inferred directly from the period of the function that sends 
j onto kj . This period can be estimated from sampling in 
a discrete Fourier transform of the function. In order to 
profit from the ability of quantum computers to compute 
Fourier transforms, though, we must first create a state in 
which the amplitude of |j) is proportional to kj for values 
of j ranging over several periods. 

Let P be a power of 2, arbitrary for the moment, and 
let / = P9/tt be the number of periods of kj when j spans 
the range from to P — 1 . (In general / need not be an 
integer.) Create state 




Then apply to |^q) a transformation that sends to 
\j) G^\^), where G is the Grover iteration. This takes a 
time proportional to P, resulting in the state 



p-i 

E 

3=0 



Now, observe the second part of the register. Assume 
without loss of generality that some element from A is 
obtained. (There are no essential differences if instead an 
element from B is obtained since kj and ij have exactly 
the same period.) At this point, the first part of the 
register has collapsed to state 



p-i 



E^'> 



3=0 
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up to renormalization. If we apply a quantum discrete 
Fourier transform to this state || (not what Grover calls 
the quantum Fourier transform in 0!), and if / is large 
enough, the amplitude of all values of j becomes vanish- 
ingly small, except for values very close to / or P — f. 
Finally, we observe the register. With high probability, 
this yields an excellent approximation / on /, from which 
we estimate 



p 



and t = N sin 2 9 . 



To evaluate the accuracy of t, we assume that 
| / — /| < 1, which happens with reasonable proba- 
bility provided / is sufficiently large — see gj for 
details. It follows that \9 — 9\ < tt/P and there- 
fore | sinO — sin6>| < n/P as well. From £ = Asin 2 6!, 
t = N sin 2 9 and sin 9 = y/t/N, we derive 



t-t < 



<tN 



p2 



A. 



(4) 



Recall that the running time of the algorithm is propor- 
tional to P. This parameter allows us to balance the 
desired accuracy of the approximation with the running 
time required to achieve it. Let c be a constant. 

o If we take P — cy/~N , the error in our estimate of t is 
bounded by + ^ provided |/ - /| < 1. This is 

reminiscent of finding the answer up to a few stan- 
dard deviations. 

o If we are satisfied with keeping small the relative er- 
ror, we run the algorithm on successive powers of 2 
for P until / becomes reasonably large. This will 
happen when P — cyf N/t. After a total time pro- 
portional to y/ N/t, this yields an estimate for t that 
is likely to be within a factor (1 + tt/c) 2 of the correct 
answer. 

O If we want the absolute error to be probably bounded 
by a constant, we apply the algorithm once with 
P = cyN in order to estimate t. Then, we run 
it again, but with P = cVtN. According to equa- 
tion (ji|) , and pretending P = cyftN for simplicity, the 
resulting error in our second estimate of t is likely to 
be bounded by — + In particular, we get the 
exact answer, provided \f — f\ < 1, if we take c > 14 
since — + < 1/2 in that case. (Note that succes- 
sive applications of Grover's algorithm in which we 
strike out the solutions as they are found will also 
provide an exact count with high probability in a 
time in 0(y/ tN ), but at an enormous cost in terms 
of additional memory — see 

o Finally, we have a variation on this technique that 
gives the exact answer in a time in 0(y/W ) with a 



vanishingly small probability of error provided the 
number of solutions is a small perfect square. 

We defer the details to ||. 

6 Implementation considerations 

Grover's algorithm consists of a number of iterations fol- 
lowed by a measurement. In his original article [Q Grover 
shows that the unitary transform G, defined below, effi- 
ciently implements what we called an iteration in §|^. 

For every A C Zjv, let Sa be the conditional phase 
shift transform given by 



S A \i) = 



\i) if % e A 
\i) otherwise. 



For every i 6 Iin, denote by Si. Let T be the Walsh- 
Hadamard transform 



N-l 

v i=0 



where i ■ j denotes the bitwise dot product of the two 
strings i and j . Then the transform G is given by 

G = —TSoTSi . 

Grover considers only the case when A is a power of 2 
since the transform T is well-defined only in this case. 
However, the assumption on A can be removed by observ- 
ing that G is just one of many transforms that efficiently 
implements an iteration. Let T' be any unitary transform 
satisfying 

1 N ^ 

no, . ^ y. »■ («) 

Then one may easily verify that the transform 
T'SqT' 1 Si works just as well, and, more interestingly, 
that 

T'SqT'^Sa 

implements the general iteration analysed in Any 
transform T 1 satisfying (^) can thus be used in the al- 
gorithm. 

When A is a power of 2, the Walsh-Hadamard trans- 
form is indeed the simplest possible choice for T'. When 
A is not a power of two, the approximate Fourier trans- 
form given by Kitaev can be used. 

7 An improved lower bound 

Drawing on general results from |EJ, Grover points out 
that any algorithm for quantum database searching must 
take a time at least proportional to VA when there is 
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a unique solution. Here we refine and generalize this re- 
sult by giving an explicit lower bound on the number of 
table lookups required by any quantum algorithm as a 
function of the number of solutions. This lower bound is 
only a few percent smaller than the number of iterations 
required by Grover's algorithm when the number of solu- 
tions is known in advance. Unfortunately each iteration 
of Grover's algorithm requires two table lookups because 
T[i] must first be fetched (to decide on potential phase 
shift) and then it must be erased (to allow interference to 
take place) by a process often referred to as uncomputa- 
tion. Therefore, we merely prove that Grover's algorithm 
is roughly within a factor 2 of being optimal in terms of 
the number of table lookups. 

We rephrase the problem in terms of an oracle O defined 
so that 0(i) — 1 whenever i is a solution. All matrices and 
vectors in this section are finite and complex-valued. Let 
the inner product (a, b) of two vectors a and b be defined 
as J2i a *bi: where c* denotes the complex conjugate of c. 
The norm of a is denoted ||a||. The absolute value of a 
complex number c is denoted |c|. 

We restate a basic fact on complex- valued vectors: 

Proposition 4 For all normalized vectors a and h, and 
all complex scalars a and (3, 



aa - 



/3bf> M 2 



2\a\ 



The following proposition is a consequence of Cheby- 
shev's summation inequalities. 

Proposition 5 For all set of complex numbers, {a^i}i=o > 



Lemma 6 Let S be any set of N strings, and C be any 
configurationspace. Let \(f>o} be any superposition, and 

\c(> r ) =U r ...U 2 U 1 \4> ) 

any sequence of r unitary transforms. Let {/i}[ =0 oe am7 
set of partial functions from C into S. For any y 6 S, let 

W r ) = u' r ...u^u' 1 \^) 

be any sequence of r unitary transforms where for all 
i = l,...,r, 

Ul\c)=U i \c) if fi-i{\c))*y. 

Set |</>o) = \(f>o), and for all i = l,...,r, set \<pi) = 
andWi) = For all i = 0,1,..., r, set 

\4>i) = ®i,y\4>i,y) + Ui,y\(i>i,y) , where \4>i,y) i\<p it y)) is the 
normalized superposition of configurations where fi (does 
not) equals y. Denote \4>'i) similarly. 

Then the following holds: 



1. |||^.)-|^r)||<2Eto 1 K»| for ally eS 

2. 2{l-KJ-|o/ r -|}< \\W r )-\A)f for ally eS 

3. N-VN-J2yesKy\<^ 2 

Proof. We divide the proof into three parts. 

Proof of (1): For all y S S, and all i = 1, . . . , r we have 

U'i\4>i-l) = U- (on-x^i-l^y) + QJj-l^l^i— 

= U- (a 4 _i^|0 4 _i^)) + Ui (ai_i,j?|0i-i : y)) 

= U[ (a 4 _i. y |(/) 4 _i. y )) - Ui (oi-x^i-i^)) + Ui\(j)i-x) 

= \<t> i ) + {U' i -U i ){a i - hy \4> i - l>v )). 

Hence, by induction on i, 

W i ) = u' i ...u> 1 \<t> (3 ) 

= + £5 = 1 ■ ■ • U' j+1 ){U' S - U 3 ) (a^.yl^.y)) , 

so. 

\<m\\ 

= II £| = l(^ • • • U'mWj - Uj) {a 3 ^,y\^y)) || 

< 2 Ej=i \ a j-hvl 

and (1) follows. 

Proof of (2) : The identity follows from: 

lll#>-l<MII 

= \\{<M,y)+<M,y)) 

- {Ot r} y\4> ri y) + a ri y\4> ri y))\\ 

= \\(K,yWr,y) ~ &r,y\(t>r,y)) 

+ K,y\€,y) ~ ar,y\4r,y))\\ 
= {WKJ^y) ~ <Xr,v\<i>r,v)\\' 

> {(K.yf + Wr,y\ 2 - 2KJ\a r J) 

+ (K^| 2 + l«^l 2 -2|< ? ||a^|) 2 } 1/2 
= {2- 2(\a' r J\a r J + Ky\\a r ,y\)} 1/2 
= V2{l-\a> r J\a r J-\a'J\a r .ji\} 1/2 



1/2 



> s/2{l-\a r , v \-\a'\} 



1/2 



where the two inequalities follow from proposition |j and 
the fact that the absolute value of any scalar is at most 
one. 

Proof of (3): By (2), (1), and proposition [| 

1, 



i-Kvl-Kvl < dlK)-l<MI 



< 



2 E K»l 



< 



2rEl«vyl 



4=0 



Thus, 

Ea 

yes 



o>r tV \ - | a 



r,y\) < E 2r E 



H,y\ 



y£S \ i=0 
r-1 



2-E Ew 2 | = 2r 

,:=0 \y£S 
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Since, 



yes 



a r ,J - a: 



E Kfl 



yes 



yes 



1/2 



>iV- ViV ^ 
\yes 

yes 



E Kl/I 
yes 



we have 

N - ^ - E Ksi < E(! - i a ^l - Kv\) ^ 2r2 > 

yes yes 
and (3) follows. I 

Theorem 7 Let S be any set of N strings, and M be 
any oracle quantum machine with bounded error prob- 
ability. Let y S be a randomly and uniformly cho- 
sen element from S. Put O to be the oracle where 
0(x) — 1 if and only if x — y. Then the expected num- 
ber of times M must query O in order to determine y with 
probability at least 1/2 is at least L(sin(-7r/8))\//V| . 

Proof. Let 5* be any set of N strings and C be any config- 
urationspace. Let |^o) be any superposition of configura- 
tions, and M any bounded-error oracle quantum machine. 
Given any oracle O* , assume that we run M° for s steps, 
and assume that M queries its oracle O* r times during 
the computation. Since we will only run M using oracle 
O* with 0*(x) = if x ^ S, without loss of generality, 
assume that M never queries O* on strings not in S. 

First, consider the case that we run M using the trivial 
oracle: let O be the oracle where 0{x) = for all x E S, 
and let 

\tP s )=A s ...A 1 \tP ) (6) 

be the unitary transformation corresponding to the com- 
putation of M using oracle O. 

For all i = 1, . . . , r, set qi to be the timestamp for M's 
i'th query, and set q r +i = s + 1. Then (^) can also be 
written as 

\4>r) = U r ■ 



Ux\4> ) 



(7) 



and for all i = 1 , . . . , r, 

= Ui\(j)i-i). At the i'th 



where \4> ) = A qi -i . . . Aifyo) 
Ui = Aq i+1 -i . . . A qi and |^) 
query some configurations will query O, some will not. 
For all i = 0, . . . , r — 1, set /i(|c)) = x if |c) queries x at 
the i + I'th query. 

Now, consider what happens if we flip one bit of the 
oracle bits: Given any y £ S, let O' be the oracle where 
O' (x) = 1 if and only if x = y. Then the computation of 
M° corresponds to the unitary transformation 

\(j>' r ) = U l r ...U l l \(l> ) 



vrhexeUl\c) = U i \c)ilf i -i(\c))?y. 

At the end of the computation of M° , we measure the 
superposition \(j)' r ) in order to determine the unknown y. 
For each configuration |c) € C, set /r(|c)) = x if, by mea- 
suring |c), M answers that x is the unknown y. 

Set W r ) = +<-\4>> r -) where \^ y ) (|^-)) is 

the normalized superposition of configurations where f r 
(does not) equals y. Then |aj, a | 2 is the probability that 
M° correctly determines y. Since, by assumption, this 
probability is at least 1/2, 



Kv\ < T2 



for all y G S. 



Furthermore, by Lemma ^, 



Hence, 



yes 



2r 2 > N-VN-J2Ky\ 

yes 



> N - vJV -=N 

V2 



(i-^iv-ViV, 



r > (2-V2) T - — 



1/2 



\ VN 2 



= (sin(7r/8))VW - 1, 

which proves the theorem. I 

Theorem [?] gives a lower bound for finding a unique 
feasible y G S using a bounded-error quantum machine. 
However, in most applications we would expect that there 
will be more than one feasible y, say t such y's. Further- 
more, we might even not know if there is a feasible y or 
not. For the case t > 1, we have: 

Theorem 8 Let S be any set of N strings, and M be 
any bounded-error oracle quantum machine. Let iCjjS 
be a randomly and uniformly chosen subset of S of size t, 
t > 1. Put O to be the oracle where 0(x) = 1 if and only 
if x G A. Then the expected number of times M must 
query O in order to determine some member y G A with 
probability at least 1/2 is at least |_(sin(7r /8))^ \_N/t\ J . 
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The proof of this theorem is almost identical to the 
proof of Lemma ^| and Theorem [?]. In Lemma equations 
(1) and (2) now hold for all subsets of i strings. Hence, by 
choosing a largest number of such disjoint subsets from S, 
say T = {Xi, X Nt } where N t = [N/t\ , in the proof 
of (3), we obtain 

N t -^/N t - £ \ a ' r -\<2r 2 . 

The remaining part of the proof is the same as the proof 
of Theorem [7J only with obvious and minor changes. 
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